Implementation of Schools Finance System City of York Council Internal Audit Report 2015/16

Business Unit: Adults, Children & Education, Responsible Officer: Assistant Director Education & Skills Service Manager: Headteachers Date Issued: 09/09/2016 Status: Final Reference: 15699/010

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction The new web based Financial Management System (replacing RM finance) has been live in schools from 1st April 2015. The chosen system was Civica Financials Web with a Civica Purchasing System. Each school is set up as a separate department with access through their server to their own data only. Central administrators have full access rights across all schools through Citrix. All access rights, passwords and supplier lists are set up and controlled centrally. It is planned that the system will eventually operate with electronic payments however, until this is in place schools will continue to use printed or manual cheques.

Objectives and Scope of the Audit The purpose of the audit was to provide assurance to management that effective controls were in place at schools for the operation of the new Financial Management System.

The key objectives of the audit were to ensure:

- The Civica Purchasing System is used in compliance with the schools delegated authority and CYC Financial Regulations.
- Debtors invoices are raised through the debtors module
- System reports and notifications to ensure complete and accurate processing of income and expenditure are checked and retained as required
- System reconciliations and checks are completed to confirm the balances of the accounting records and returns are correct (to cover bank reconciliation, VAT, central fund)
- Budgets are correctly uploaded and monitoring reports produced on a regular basis

A review of procedures in place at a sample of five schools was included as part of this audit.

Key Findings Civica Financials Web and the Civica Purchasing System were introduced in all schools from 1/4/15 with some limited functionality. In particular the facility to upload income received to Financials Web was not available to schools until late June, completion of bank reconciliation and production of budget monitoring reports were not available until September 2015. It was found that most schools in the sample tested had engaged with the new systems as they became available. Creditor accounts for regular suppliers had been set up centrally. However some initial delays in the opening of new creditor accounts requested by the schools had resulted in extended use of manual ordering and manual cheque payments. Some training and technical issues at individual schools had also resulted in some delays in the use of Civica Purchasing.

For all schools included in the review there was evidence to confirm that financial records were well maintained. However at the time of the review:

- One school had not introduced Civica Purchasing due to problems in agreeing staff user levels
- One school was not using FW debtors module for raising debtor invoices
- Two schools had not continued to ensure there was evidence of independent verification that all cheque stationery was accounted for.
- At three schools there were errors found in the budgets recorded onto Financials Web

All findings relating to individual schools were reported to the school at the end of the audit visit.

**Overall Conclusions**

It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance. 1 Civica Purchasing

| Issue/Control Weakness | Risk | |------------------------|------| | One school had not set up user permissions on the Civica Purchasing System and continued to use a manual ordering system. | Committed expenditure is not recorded on the schools accounting system and overspends may occur. Official orders may not be raised by the school which may result in unauthorised expenditure and duplicate payments. |

Findings

At the time of the visits four of the five schools were using the Civica Purchasing System to order goods and services, confirm receipt of goods and process the invoice for payment. Permissions on the Civica Purchasing System had been set in compliance with the Governors approval of delegated authority to post holders. It was found that:

1. One school had not set levels of access and permissions for the system due to a failure to agree staff responsibilities for approving, ordering and goods receiving for goods and services. Manual orders were being raised and controls were in place to ensure all purchases were approved and goods were received before payments were made through Financials Web. This was discussed with the school and it was agreed that a proposal would be submitted to committee so that appropriate permissions could be set up for the Civica Purchasing System for the new financial year.

2. It was noted that at any point prior to payment of the invoice the supplier/payee can be changed on the Civica Purchasing System to any registered payee. If the payee is changed in error this should be identified when the payment is checked to the invoice by the cheque signatories.

Agreed Action 1.1

1. The school concerned was offered and accepted additional support in the form of an information giving meeting. Since that meeting and the production of this report the school has decided to procurement their own system. It is understood, however, that the problem of agreeing staff responsibilities with an appropriate separation of duties remains.

2. A solution to this matter will be discussed with colleagues in Corporate a/c’s responsibility for the Council’s Civica system then if necessary referred to Civica.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business and Monitoring Officer | 31st December 2016 |

## 2 Cheque Logs

| Issue/Control Weakness | Risk | |------------------------|------| | Two out of the five schools visited did not maintain evidence that all cheque stationery was accounted for. | Cheques may be lost or stolen and fraudulent payments may be made. |

### Findings

Only three of the five schools visited maintained a cheque log recording all used cheques and cancelled or spoilt cheques in the cheque run and signed to evidence independent verification that cheque numbers follow on from the previous run and that all cheques in the run are accounted for.

### Agreed Action 2.1

At the training provided for School finance staff on the Financials Web system and subsequently via the weekly Schools’ Bulletin, schools were advised to maintain a list of cheques used either by continuing with the manual log or using the Cheques Used Report generated by the system. A colleague from Corporate a/c’s, who is familiar with Civica’s report writing facility Crystal Reports, is to be asked to add appropriately titled spaces on the Cheques Used Report for cheque signatories to sign to verify the cheque numbers used including any spoilt or cancelled.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business and Monitoring Officer | 31st December 2016 |

### 3 Debtor Invoices

| Issue/Control Weakness | Risk | |------------------------|------| | One school was not raising invoices through the Debtors System, but continued to raise manual pro-forma invoices. | Failure to ensure all income is collected and to account for income due. |

### Findings

Four out of five schools were using the debtors module on Financials Web to raise debtor invoices. One school had not as yet engaged with this and had continued to use the manual pro-forma invoice system. Although there was little invoiced debtor income it was agreed by the school that new invoices would be raised through Financials Web.

### Agreed Action 3.1

Since drafting this report the one school found not to have engaged with the Debtors module has decided to procure their own accounting software.

Other schools are to be asked to return any unused Pro-forma Invoice pads.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business and Monitoring Officer | 30th September 2016 |

### 4 Income Upload

| Issue/Control Weakness | Risk | |------------------------|------| | For one school income uploads were not cross referenced to bankings. The income upload was completed to match income appearing on the bank statements. | Monitoring reports and debtor records may not be up-to-date. Errors in accounting records or at the bank may not be promptly identified and investigated. |

**Findings**

Records at five schools were tested to ensure that all income received was recorded on an income upload record, that the upload record was cross referenced to the banking and confirmation of upload retained.

It was found that one school did not cross reference income upload records to bankings. The income upload to Financials Web was adjusted to match the income on the bank statement prior to the bank reconciliation being completed. This system had been operated by the school to facilitate accounting for cash and cheques being split on the bank account. The school accounts were therefore not promptly updated with income received and the bank reconciliation did not identify income received and banked but not yet appearing on the statement. The school however separately checked all paying in records to the bankings. This practice was discussed with the school and it was agreed that an alternative system would be introduced to ensure prompt upload of income and cross reference between income upload and bankings.

**Agreed Action 4.1**

It was agreed that this Issue is to be given Observation status therefore no response is needed.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | N/A | N/A | 5 Budget Monitoring

| Issue/Control Weakness | Risk | |------------------------|------| | There were errors in the budget recorded onto Financials Web at three of the five schools tested. | Accurate information may not be available for budget monitoring and spend may not be effectively controlled. |

Findings

All schools visited were producing regular budget monitoring reports. However it was noted that the brought forward balance was not recorded on the report.

For all the schools the approved start and revised budgets were checked to Financials web to ensure they had been accurately recorded. At three of the schools there were errors on the budgets recorded on Financials Web. The error at one school related to capitalised revenue not appearing on the capital budget and at the other two schools related to capital expenditure being incorrectly recorded on the budget. These errors were highlighted at the schools for correction.

For all transactions tested the accuracy of coding of income and expenditure was verified. No coding errors were noted.

Agreed Action 5.1

The principle that actual income and expenditure must be monitored against the Start or Revised Budget approved by Governors has not changed with the introduction of Financials Web. School staff were informed of this at the training courses on which the production of Monitoring Reports was covered.

Civica have been reminded of the requirement for brought forward balances to be shown appropriately on Monitoring Reports and asked to complete this piece of work as soon as possible.

| Priority | Responsible Officer | Timescale | |----------|---------------------|-----------| | 3 | School Business and Monitoring Officer | 31st December 2016 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |-----------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | |-----------------------|-------------------------------------------------------------------------------------------------------------------------------| | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.